Comment by viraptor

Let's be clear here: they provided a waf rule. You need to actually have it enabled to be protected.